CVE-2022-30635
Stack exhaustion when decoding certain messages in encoding/gob
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
Una recursión no controlada en el archivo Decoder.Decode en encoding/gob versiones anteriores a Go 1.17.12 y Go 1.18.4, permite a un atacante causar un pánico debido al agotamiento de la pila por medio de un mensaje que contiene estructuras profundamente anidadas
A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
Multicluster engine for Kubernetes 2.1 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy. Issues addressed include a denial of service vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-12 CVE Reserved
- 2022-08-04 CVE Published
- 2024-08-03 CVE Updated
- 2025-05-28 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-674: Uncontrolled Recursion
- CWE-1325: Improperly Controlled Sequential Memory Allocation
CAPEC
References (7)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://go.dev/cl/417064 | 2023-11-07 | |
https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7 | 2023-11-07 |
URL | Date | SRC |
---|---|---|
https://go.dev/issue/53615 | 2023-11-07 | |
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE | 2023-11-07 | |
https://pkg.go.dev/vuln/GO-2022-0526 | 2023-11-07 | |
https://access.redhat.com/security/cve/CVE-2022-30635 | 2023-06-21 | |
https://bugzilla.redhat.com/show_bug.cgi?id=2107388 | 2023-06-21 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | < 1.17.12 Search vendor "Golang" for product "Go" and version " < 1.17.12" | - |
Affected
| ||||||
Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | >= 1.18.0 < 1.18.4 Search vendor "Golang" for product "Go" and version " >= 1.18.0 < 1.18.4" | - |
Affected
|